Queue Server Side Encryption

01 Sign in to the AWS Management Console.

02 Navigate to Amazon SQS console at https://console.aws.amazon.com/sqs/.

03 In the main navigation panel, under Amazon SQS, choose Queues.

04 Click on the name (link) of the SQS queue that you want to examine.

05 Select the Encryption tab from the console bottom panel and check the Server-Side Encryption (SSE) feature configuration. If there is no SSE configuration available in this section, instead and the following message is displayed: "No server-side encryption is set for this queue.", Server-Side Encryption is not enabled for the selected Amazon SQS queue, therefore your SQS data at-rest is not encrypted on Amazon SQS servers.

06 Repeat steps no. 4 and 5 for each Amazon SQS queue available within the current AWS region.

07 Change the AWS cloud region from the navigation bar and repeat the Audit process for other regions.

01 Run list-queues command (OSX/Linux/UNIX) to list the URL of each Amazon SQS queue available in the selected AWS cloud region:

aws sqs list-queues
  --region us-east-1
  --query 'QueueUrls[*]'

02 The command output should return an array with the requested SQS queue URLs:

[
    "https://sqs.us-east-1.amazonaws.com/123456789012/cc-web-app-worker",
    "https://sqs.us-east-1.amazonaws.com/123456789012/cc-mobile-app-queue"
]

03 Run get-queue-attributes command (OSX/Linux/UNIX) using the URL of the SQS queue that you want to examine as the identifier parameter and custom query filters to determine if the Server-Side Encryption (SSE) feature is enabled for the selected SQS queue:

aws sqs get-queue-attributes
  --region us-east-1
  --queue-url https://sqs.us-east-1.amazonaws.com/123456789012/cc-web-app-worker
  --attribute-names "SqsManagedSseEnabled" "KmsMasterKeyId"
  --query 'Attributes'

04 The command output should return the requested configuration information (i.e. the SSE-SQS configuration flag or the KMS key ID):

{
  "SqsManagedSseEnabled": "false"
}

05 Repeat steps no. 3 and 4 for each Amazon SQS queue available in the selected AWS region.

06 Change the AWS cloud region by updating the --region command parameter value and repeat the Audit process for other regions.

01 CloudFormation template (JSON):

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Enable Server-Side Encryption (SSE)",
  "Parameters": {
    "SQSQueueName": {
      "Default": "cc-worker-queue",
      "Description": "SQS Worker Queue",
      "Type": "String",
      "MinLength": "1",
      "MaxLength": "63",
      "AllowedPattern": "^[0-9a-zA-Z-/]*$",
      "ConstraintDescription": "Must begin with a letter and must not end with a hyphen or contain two consecutive hyphens."
    }
  },
  "Resources": {
    "SQSDeadLetterQueue": {
      "Type": "AWS::SQS::Queue"
    },
    "SQSSourceQueue": {
      "Type": "AWS::SQS::Queue",
      "Properties": {
        "QueueName": {
          "Ref": "SQSQueueName"
        },
        "RedrivePolicy": {
          "deadLetterTargetArn": {
            "Fn::GetAtt": ["SQSDeadLetterQueue", "Arn"]
          },
          "maxReceiveCount": 5
        },
        "KmsMasterKeyId": "alias/aws/sqs",
        "KmsDataKeyReusePeriodSeconds": 300
      }
    }
  }
}

02 CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
AWSTemplateFormatVersion: '2010-09-09'
Description: Enable Server-Side Encryption (SSE)
Parameters:
  SQSQueueName:
    Default: cc-worker-queue
    Description: SQS Worker Queue
    Type: String
    MinLength: '1'
    MaxLength: '63'
    AllowedPattern: ^[0-9a-zA-Z-/]*$
    ConstraintDescription: Must begin with a letter and must not end with a hyphen
      or contain two consecutive hyphens.
Resources:
  SQSDeadLetterQueue:
    Type: AWS::SQS::Queue
  SQSSourceQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Ref 'SQSQueueName'
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt 'SQSDeadLetterQueue.Arn'
        maxReceiveCount: 5
      KmsMasterKeyId: alias/aws/sqs
      KmsDataKeyReusePeriodSeconds: 300

01 Terraform configuration file (.tf):

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.27"
    }
  }

  required_version = ">= 0.14.9"
}

provider "aws" {
  profile = "default"
  region  = "us-east-1"
}


resource "aws_sqs_queue" "sqs-queue-deadletter" {
  name = "cc-dead-letter-queue"
}

resource "aws_sqs_queue" "sqs-queue" {
  name                  = "sqs-worker-queue"
  redrive_policy = jsonencode({
    deadLetterTargetArn = aws_sqs_queue.sqs-queue-deadletter.arn
    maxReceiveCount     = 5
  })

  # Enable Server-Side Encryption (SSE-KMS)
  kms_master_key_id                 = "alias/aws/sqs"
  kms_data_key_reuse_period_seconds = 300

  # Enable Server-Side Encryption (SSE-SQS)
  # sqs_managed_sse_enabled = true
}

01 Sign in to the AWS Management Console.

02 Navigate to Amazon SQS console at https://console.aws.amazon.com/sqs/.

03 In the main navigation panel, under Amazon SQS, choose Queues.

04 Click on the name (link) of the SQS queue that you want to reconfigure.

05 Select the Encryption tab from the console bottom panel and choose Edit.

06 On the Edit <queue-name> configuration page, select the Encryption – Optional tab and perform the following operations:

1. Select Enabled under Server-side encryption to turn on the Server-Side Encryption (SSE) feature.
2. For Encryption key type select one of the following options:
   • To use the AWS-managed key created for Amazon SQS (i.e. SSE-SQS), select Amazon SQS key (SSE-SQS). The Amazon KMS service creates this AWS-managed key the first time when you request it.
   • To use a KMS Customer Master Key (CMK), select AWS Key Management Service key (SSE-KMS). Choose the desired CMK from the Customer master key dropdown list or select Enter the CMK alias and paste your key alias into the CMK alias box.
3. (Optional) For Data key reuse period, provide a value between 1 minute and 24 hours.
4. Choose Save to apply the configuration changes.

07 Repeat steps no. 4 – 6 to enable Server-Side Encryption (SSE) for other Amazon SQS queues available within the current AWS region.

08 Change the AWS cloud region from the navigation bar and repeat the Remediation process for other AWS regions.

01 Define the required parameters for the set-queue-attributes command and save them to a JSON file named cc-enable-sse.json. Based on the encryption key type used (AWS-managed or KMS CMK), choose to define one of the following set of parameters:

1. To use the AWS-managed key created for Amazon SQS (i.e. SSE-SQS):
   {
     "SqsManagedSseEnabled": "true"
   }
   

2. To use a KMS Customer Master Key (CMK). Replace <kms-cmk-arn> with the ARN of the desired Customer Master Key (CMK):
   {
     "KmsMasterKeyId": "<kms-cmk-arn>",
     "KmsDataKeyReusePeriodSeconds": "300"
   }
   

02 Run set-queue-attributes command (OSX/Linux/UNIX) using the URL of the Amazon SQS queue that you want to reconfigure as the identifier parameter and the policy document defined at the previous step (i.e. cc-enable-sse.json), to enable Server-Side Encryption (SSE) for the selected SQS queue (the command does not produce an output):

aws sqs set-queue-attributes
  --region us-east-1
  --queue-url https://sqs.us-east-1.amazonaws.com/123456789012/cc-web-app-worker
  --attributes file://cc-enable-sse.json

03 Repeat steps no. 1 and 2 to enable Server-Side Encryption (SSE) for other Amazon SQS queues available in the selected AWS region.

04 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 3 to perform the Remediation process for other regions.